Safely auditing IoT and industrial device services
You write safe testing rules for fragile devices, build a passive inventory from traffic, audit default passwords, MQTT permissions and segmentation on simulated IoT and industrial services, and propose compensating controls for unpatchable devices.
Level 501 · 14 lessons · 15 practice labs
Lessons
Special care
- Why these devices are different: fragility and physical impact
- Safe testing rules: passive first, intensity limits, approved windows
- A passive device inventory from traffic
- Short task: write testing rules for a production plant
IoT services
- Finding devices with default passwords and changing them
- Authentication and topic permissions on an MQTT broker
- Exposure of IP camera web interfaces and stream services
- Tracking firmware versions
- Short task: audit and harden the simulated IoT network
Industrial protocols
- Modbus: getting to know a protocol without authentication
- The Purdue model and segmentation review
- Passive monitoring and anomaly detection on an industrial network
- Compensating controls for devices that cannot be patched
- Capstone: audit and report a simulated plant’s IoT and industrial network with passive methods
Practice labs
- Write testing rules for a production plant: Prepare a testing-rules document for Ilgıntepe Tekstil's factory covering passive-first methods, intensity limits and an approved time window.
- Make a dangerous test plan safe: Find the risky steps in a teammate's plan that full-scans industrial devices and rewrite them with passive, limited alternatives.
- Write the steps to follow if a device stops responding during testing: Prepare a stop criteria, contact chain and rollback plan for Çamlıbel Su İdaresi's pump controller in case it stops responding during testing.
- Build a passive device inventory from a traffic capture: Extract device addresses, vendors and protocols from the simulated plant's packet capture and prepare an inventory table.
- Find an unidentified device in the passive inventory and query its owner: Compare the passive inventory with the registered device list, characterise the unregistered device's protocol behaviour and notify its owner.
- Find anomalous communication in the industrial network with passive monitoring: Build a baseline traffic profile, find the flow sending write requests to a controller from the office network and report it with an incident note.
- Find and list devices with default passwords: Check the management interfaces of devices in the simulated IoT network against the lab's default password list and mark those still on defaults.
- Harden an IP camera's web and streaming services: Change the password on Mercanköşk Otelcilik's lab camera, close the unauthenticated stream, disable unneeded services and audit again.
- Set up firmware version tracking and report outdated devices: Add the firmware versions of ten simulated devices to the inventory, compare them with vendor bulletins and prioritise the update plan.
- Check anonymous access on an MQTT broker: Try connecting to the lab MQTT broker without credentials and record which topics can be read in the findings table.
- Add authentication and topic permissions to an MQTT broker: Disable anonymous access, define separate users for sensors and the dashboard, grant each only the topics it needs and test.
- Encrypt MQTT traffic and re-verify all clients: Enable TLS on Ayçiçeği Gıda's cold-storage broker, close the plaintext port and prove from a traffic capture that five clients connect encrypted.
- Identify Modbus traffic and document its lack of authentication: Separate Modbus read and write requests in the simulated plant capture and explain in a finding note that the protocol has no authentication.
- Audit segmentation against the Purdue model: Place the devices in Demirsu Enerji's lab network on the levels and list the flows allowed across levels against the rules.
- Apply and report compensating controls for an unpatchable device: Apply an access list, one-way monitoring and change alerts for a controller that cannot be updated, and write the simulated plant's audit report.
About this course
You write safe testing rules for fragile devices, build a passive inventory from traffic, audit default passwords, MQTT permissions and segmentation on simulated IoT and industrial services, and propose compensating controls for unpatchable devices.
What you will learn
- Special care
- IoT services
- Industrial protocols
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.